This vulnerability in mf-yang openclaw-cn up to version 0.2.1 involves improper handling of the url argument in the assertBrowserNavigationAllowed function of the Scheme Handler component. This improper validation or control allows an attacker to cause information disclosure remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating it is exploitable over the network with low complexity and no privileges or user interaction required. The project was notified early but has not issued a patch or official remediation.

Successful exploitation of this vulnerability allows an attacker to disclose information that should be protected by the application. The information disclosure could aid further attacks or leak sensitive data. No privilege or user interaction is required, and the attack can be performed remotely. However, the impact is limited to information disclosure without integrity or availability effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, consider restricting access to affected versions or implementing additional controls to limit exposure of the vulnerable component.